Corporate Governance, Ethics, and Internal Controls
What this domain tests
This domain tests board and management responsibilities, the three lines model, risk appetite, conflicts of interest, ethics, whistleblowing, internal audit independence, and internal control over financial reporting. Questions often ask who owns a control, who provides assurance, and what evidence proves board oversight.
Core rules and concepts
- The board approves strategy, risk appetite, senior appointments, and key policies; management executes within that framework. Board minutes should show challenge and decisions, not just attendance.
- The three lines model distinguishes operational management and controls, independent risk and compliance functions, and internal audit. Internal audit reports to the audit committee and must be independent of management.
- A code of ethics covers conflicts, gifts, confidentiality, and escalation. Related-party transactions require recusal and approval under policy and applicable law.
- Whistleblowing channels must allow confidential reporting and be free from retaliation.
- Internal control frameworks require control environment, risk assessment, control activities, information and communication, and monitoring. A material weakness is a deficiency, or combination, that creates a reasonable possibility of material misstatement not being prevented or detected timely.
Worked example
A loan officer recommends approval of a USD 2 million loan to a company owned by the officer's sibling. The officer should disclose the relationship, recuse from the credit decision, and route the request to an independent approver under the related-party policy. The board or committee should review the transaction if policy requires. Simply documenting the relationship while allowing the officer to vote is not sufficient; the control fails because the conflicted person influenced the outcome.
Traps that cost marks
- Saying the board manages day-to-day controls; it oversees and approves.
- Treating compliance as the third line; it is usually the second line.
- Confusing a control deficiency with a material weakness.
- Allowing a conflicted approver to participate with disclosure alone.
- Treating ethics as tone at the top only, without escalation, testing, and consequences.